USPS picks vendor for cloud-based ID management hub

By Frank Konkel

Aug 21, 2013

The federal government’s first major test of cloud-based identity management now has a vendor.

A contract to develop the Federal Cloud Credential Exchange (FCCX), a cloud-based hub that will allow people to use third-party credentials to efficiently and securely access multiple federal websites and services, went to Toronto-based SecureKey Technologies, FCW has learned.

Under the deal, USPS will enter into a firm fixed-price contract with SecureKey Technologies with a one-year value of $2.4 million. If two additional one-year options are exercised, the contract’s value could jump to as much as $15 million.

FCCX is an outgrowth of the White House’s National Strategy for Trusted Identities in Cyberspace, launched in 2011. NSTIC aims to create an identity ecosystem in which people can tap private or public identity providers for trusted third-party credentials that allow users to log into multiple government resources.

Most agencies have separate in-house identity management systems that require users to create different usernames and passwords for the agency sites and services they access. FCCX would streamline relationships between participating trusted identity providers and agencies by brokering externally issued digital credentials to grant people access to certain federal websites and services.

In an interview with FCW for a previous story, Naomi Lefkovitz, senior privacy policy adviser at the National Institute of Standards and Technology, said FCCX could help the federal government reduce costs through repetitive credentialing and alleviate username and password issues for citizens.

"Those are really the efficiencies -- and the good customer experience -- we are looking for," said Lefkovitz, who also co-led the FCCX Tiger Team that identified the cloud system's requirements and technical architecture.

That team, which consisted of USPS, the General Services Administration and NIST, began exploring the possibilities for FCCX last year, but it is unclear which agencies will be the first to try the system once it is developed.

The Department of Homeland Security banned the Russian cybersecurity company Kaspersky Lab’s products from federal agencies in a new binding operational directive.

Reader comments

Thu, Aug 22, 2013

Really?! So we are outsourcing our nation's trusted identity credentialing services to a foreign-held company?! And who thought this was an acceptable solution for the American public? Time for some calls to our Congressmen!

Thu, Aug 22, 2013
earth

So the US government gave a contract to manage US citizens identifying information to a company that won’t be subject to US privacy laws and probably, given US citizens aren’t Canadian citizens, won’t have Canadian privacy law protections either. I think I’ll try to avoid using this till it is given to a company headquartered in the US and vote against any politician that doesn’t push for legislation requiring that. (Including requiring that this information can not be collected by the NSA, CIA…, which given that it will be crossing a US border now is fair game for them.) Our founding fathers wouldn’t recognize this government anymore.

Wed, Aug 21, 2013
Jerry Johnson

Some things should simply not be off shored. Fundamental cyber security controls is one of those things.

Wed, Aug 21, 2013

USPS release a paper on how they could be the trusted provider of digital identies to the US, kinda like they already do passport. Read their paper at http://www.uspsoig.gov/sites/default/files/document-library-files/2013/rarc-wp-12-011.pdf

Please post your comments here. Comments are moderated, so they may not appear immediately
after submitting. We will not post comments that we consider abusive or off-topic.